Bill 419

Nova Scotia’s sweeping Financial Measures Act passed just one month after 1st Reading – What it means and why you should care.

source: substack.com/@owlbynight

For those of you who don’t know, Bill 419, known as the Financial Measures Act, is a Government bill which, according to the Nova Scotia Legislature, is “An Act Respecting Certain Financial and Other Government Measures”. It was tabled on March 5th 2024, went through 2nd reading, law amendments committee, committee of the Whole House, then was given 3rd reading, debated and passed on April 5th 2024. All of this happened in the span of a month, and you probably had no idea. And yet, Bill 31 (Care and Dignity Act) which is just a fraction of the size and would no doubt make a lot of people’s lives instantly better, hasn’t moved past 1st reading since 20th October 2021.

The word “other” in the Act’s title is doing an awful lot of work here, because this bill is a sprawling omnibus bill with over 100 points (not including subpoints) that makes amendments to just about everything, from the Gaming Control Act, Consumer Protection Act, Halifax-Dartmouth Bridge Commission Act, the Income Tax Act, and far more. It even introduces the innocuously sounding “Act Respecting the Office for Children and Youth”, effectively creating yet another administrative position within an already gargantuan administration – roughly 1 in 4 people in Nova Scotia work in the public sector and government.

One of the many items that flew in under the public radar with this bill was clause 110 and the changes it has made to the Personal Health Information Act (PHIA). In full, clause 110 states:

110 Subsection 110(1) of Chapter 41 of the Acts of 2010, the Personal Health Information Act, as amended by Chapter 31 of the Acts 2012 and Chapter 22 of the Acts of 2022, is further amended by adding immediately after clause (n) the following clause:

• (na) requiring custodians and classes of custodians to disclose personal health information to the Minister or a person acting on behalf of the Minister for the purposes of planning and management of the health system, resource allocation and creating or maintaining electronic health record programs and services;

What does this mean exactly? Well, Subsection 110(1) of PHIA, to which this is an amendment, states that “The Governor in Council may make regulations…”, which means that Nova Scotia’s Lieutenant Governor will now be able to make such regulations requiring that your personal health information be disclosed to the Minister of Health.

The Canadian Independent showcased one portion of the Law Amendments Committee hearing on this bill, in which Dr. Douglas Grant makes several key points in argument against this change to PHIA, including the change in professional duty of physicians, as well as the change to the patient-physician relationship. Dr. Colin Audain, President of Doctors Nova Scotia, also voiced concerns about these changes to PHIA.

One point of contention is that this amendment requires that physicians and other custodians of personal health information disclose that information to the government.

Interestingly PHIA already has provisions – 31(l) and 38(1)(g) – which allow for the Minister to collect personal health information for the purpose of planning and management of the health system. It also already contains provisions for the Minister to collect that information for the purposes of creating or maintaining an electronic health record at 31(o). The difference now, however, seems to be that custodians will no longer be able to refuse to disclose your personal health information to the government.

So, the government have actually been able to see your personal health information for some time, one way or another, even though Health Minister Michelle Thompson, when interviewed by CTV News, stated:

“I’m not looking for records, no minister of health is going to want those records. We want real-time aggregate data. I don’t want people’s personal health records.”

Interestingly, though, MLAs Kelly Regan and Lisa Lachance both recommended changes to the wording of clause 110 to the Committee of the Whole House, such that custodians would only disclose aggregated health data that does not include individually identifiable information to the Minister. These recommendations were both defeated at the committee.

So what is the purpose of this amendment to PHIA? If you’re someone who trusts your government you might accept the reasons given by Michelle Thompson that this amendment will help to improve the healthcare system by providing the data needed to properly manage it, and it will allow us to view our own health information in the convenient yet totally redundant YourHealthNS app (redundant because you already know your private health information). However, the first issue with this is that, as stated above, the government may already access your personal health information to manage the healthcare system and an electronic health record.

The second issue can be garnered from one of Lisa Lachance’s recommendations to the Committee on this bill she suggested it be rewritten as such:

(na) requiring custodians and classes of custodians to disclose de-identified aggregate information to the Minister or a person acting on behalf of the Minister for the purpose of the existing YourHealthNS pilot project, and only until the earlier of the end of that pilot project or December 31, 2024

The very fact that this recommendation was defeated suggests that the information is to be collected for some purpose or application beyond that of the YourHealthNS app. What could that be? Speculation abounds, but the fact that the clause passed as it was written means that your health information can be used for any and all things considered to be a program or service associated with the electronic health record.

This brings me to the other points of interest that differentiates this amendment from the aforementioned provisions of PHIA, and to do that properly we need to understand the definition of some of the terms used in the bill. Law has its very own language – legalese – wherein common words we use every day actually have very non intuitive meanings.

Let’s look at what it means to be a custodian of health information:

3(f) “custodian” means an individual or organization described below who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties:

This actually makes intuitive sense (at least to me), and includes people such as the Minister, your pharmacist, doctor, the IWK etc. Basically anyone you go to see for a medical problem, or anyone acting as a health authority.

It’s the definitions of “person” and “individual” that are key here, though, because one means a real living human, and the other (surprisingly) does not.

3(m) “individual”, in relation to personal health information, means the individual, whether living or deceased, with respect to whom the information was or is being collected or created;

3(q) “person” includes a partnership, association or other entity;

A “person” then, within the realm of PHIA, really means something more like a corporate entity than a human being. This substantially changes the reading of the amendment to Subsection 110, as the “person acting on behalf of the Minister” is more accurately a third party organisation, not a couple of people inside the health department as you might have previously imagined.

Why is this significant?

Well, first there is the question of security and accountability. How much information will be disclosed – only what is relevant to the service being designed or all of it? Will our identifiable data be available to employees of this “entity” and if not, how will the government guarantee that? We’ve already seen a privacy breach of Nova Scotian’s health information earlier this year, so what safeguards will there be to ensure this doesn’t happen again?

Security is a concern on the end of the user’s device as well: what information will the program or service be pulling from the user’s device, and how will that be managed by the “person” and government? Will this third party organization use, attach or associate this data to your already available health information, to then be included as further “personal health information” that the company or Minister can also use? The YourHealthNS app currently collects your calendar information and app activity, without offering a way for you to delete the data collected about you.

The other reason that all of this is significant is that PHIA’s sections on consent (sections 11-20) do not cover personal health information in the hands of anyone other than a custodian. It is not clear from the amendment to PHIA or the Act as it stands that the “person” acting on behalf of the Minister will become a custodian by regulation. If they are not, then an individual cannot withdraw their consent to having their personal health information collected or disclosed to others by this third party organisation.

So why not withdraw consent from the actual custodians, like your doctor or pharmacist, to stop them from sharing it with the Minister and any “person” acting on behalf of the Minister?

17(6) This Section does not apply to personal health information that a custodian is required by law to collect, use or disclose, as the case may be.

Ah, well that rules that out then, since – thanks to Bill 419 – the law now requires that custodians disclose your personal health information for any new electronic programs and services the government plans with any future entity.

And that’s the real kicker of this bill. It’s not, as some are claiming, that it suddenly gives the government access to your private medical information. They took that while we were sleeping. It also doesn’t grant the Minister of Health any new powers, but it certainly grants the Lieutenant Governor a new one.

It’s worse than that. Your private medical information can now be disclosed to any entity the government partners with for almost any future purpose, and there is seemingly no way to stop it from falling into the hands of potential bad actors. Your private medical information is now quite literally available to the highest bidder.

Awesome.